3 ms·

Events can happen to anyone, even competent state-sponsored organisations. And intelligence agencies are sometimes rather less ruthlessly competent than imagine

by rgmerk 3y ago

Events can happen to anyone, even competent state-sponsored organisations. And intelligence agencies are sometimes rather less ruthlessly competent than imagined (Kremlin assisinations in the UK have been a comedy of errors [1]). Maybe another backdoor, or alternative access mechanism they were using, got closed and they wanted another one in a hurry. [1] https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvinenko https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvine...

readyplayernull 3y ago
And they are getting better at it: https://www.bbc.com/news/world-us-canada-68706317 https://www.bbc.com/news/world-us-canada-68706317
cesarb 3y ago
> Maybe another backdoor, or alternative access mechanism they were using, got closed and they wanted another one in a hurry. Or maybe the opportunity window for the mechanism this backdoor would use was closing. According to the timeline at https://research.swtch.com/xz-timeline https://research.swtch.com/xz-timeline there was a github comment from poettering at the end of January which implied that the relevant library would be changed soon to lazy load liblzma ("[...] Specifically the compression libs, i.e. libbz2, libz4 and suchlike at least. And also libpam. So expect more like this sooner or later."), as in fact happened a month later. The attacker had to get the backdoor into the targeted Linux distributions before the systemd change got into them. Of course, the attacker could instead take the loss and abandon the approach, but since they had written that amount of complex code, it probably felt hard to throw it all away.
ifwinterco 3y ago
Russia wants everyone to know when they do assassinations abroad, that's why they use obviously-Russian methods like polonium and novichok. It's designed to send a message to other Russian dissidents and remind them that they aren't safe

by rgmerk 3y ago

readyplayernull 3y ago

And they are getting better at it: https://www.bbc.com/news/world-us-canada-68706317 https://www.bbc.com/news/world-us-canada-68706317

cesarb 3y ago

> Maybe another backdoor, or alternative access mechanism they were using, got closed and they wanted another one in a hurry. Or maybe the opportunity window for the mechanism this backdoor would use was closing. According to the timeline at https://research.swtch.com/xz-timeline https://research.swtch.com/xz-timeline there was a github comment from poettering at the end of January which implied that the relevant library would be changed soon to lazy load liblzma ("[...] Specifically the compression libs, i.e. libbz2, libz4 and suchlike at least. And also libpam. So expect more like this sooner or later."), as in fact happened a month later. The attacker had to get the backdoor into the targeted Linux distributions before the systemd change got into them. Of course, the attacker could instead take the loss and abandon the approach, but since they had written that amount of complex code, it probably felt hard to throw it all away.

ifwinterco 3y ago

Russia wants everyone to know when they do assassinations abroad, that's why they use obviously-Russian methods like polonium and novichok. It's designed to send a message to other Russian dissidents and remind them that they aren't safe